EXHIBIT 11 


Case 1:23-mc-00005-UA-JLW Document 3-11 Filed 02/24/23 Page 1 of 6 


DocuSign Envelope ID: 0CE8018D-CE70-4D36-808C-F7A3C9A7C063 


BURLINGTONS 


LEGAL 
FAO: Mr Cameron Findlay Date: 23 February 2023 
C/o Egan Meyer Limited Our Ref: DPH/AZ1.3/2 
1 Mayfair Place 
London 
W1J 8AJ 


BY POST AND EMAIL: jim.meyer@eganmeyer.com; richard.egan@eganmeyer.com 


Dear Mr Findlay, 


Re: Farhad Azima -v- RAKIA & Ors (Claim Number: HC-2016-002798) 


| am a Partner at Burlingtons Legal LLP, the law firm engaged by Mr Farhad Azima to 
act for him in relation to his ongoing proceedings against, among others, Mr Neil Gerrard, 
Dechert LLP and the Ras Al Khaimah Investment Authority ("RAKIA") (the "Azima 
Proceedings"). The purpose of this letter is to alert you to matters that have come to 
light in the course of investigations into the Indian 'hack for hire' firm, CyberRoot Risk 
Advisory Private Limited ("CyberRoot"), that directly concern you. 


As you may be aware, the role of CyberRoot has been heavily scrutinised in the course 
of the Azima Proceedings. For instance, evidence has emerged that CyberRoot has 
received payment of over $1 million for work done from a company called Vital 
Management Services ("Vital"), which is controlled by Mr Nicholas Del Rosso', and that 
a material part of that work related to instructions from RAKIA's lawyers Mr Gerrard 
and/or Dechert. It has separately been confirmed by a former CyberRoot employee that 


he and others at CyberRoot hacked Mr Azima's computers and emails on the instructions 


1 Please see CyberRoot Kotak Mahindra Bank Statements as exhibited to Mr Al Sadeq's 1782 Application dated 5 
February 2022 (MDNC) (enclosed). 

2 Please see paragraph 7 of the Second Witness Statement of Nicholas Del Rosso dated 22 February 2021 and 
paragraphs 13 and 28 of the Answer and Affirmative to Defenses to Complaint (MDNC) (enclosed). 
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of Vital’. | refer you in this regard to the Re-Re-Re-Amended Counterclaim and Claim of 
Mr Azima in the Azima Proceedings, in which a public account of these allegations has 


been given (copy enclosed). 


Late last year, an intelligence agency retained by Mr Azima, Athena Intelligance, 
received from an anonymous source, within CyberRoot a Wetransfer link to 150Mb of 
CyberRoot's internal data (the "CyberRoot Data"). 


| am writing to you because the CyberRoot Data contains a number of emails that appear 
to have been prepared by CyberRoot for the purposes of hacking your electronic data. | 
set out in Annex A copies of some of these emails. | am authorised to provide you with 
this information on the basis that the images are copies of clearly non-privileged emails 
that appear likely to have previously been sent to you and, for that reason, can be 
expected to be in your possession already. | should, however, make clear that in doing 
so no waiver of privilege in respect of Athena Intelligence's instruction by Mr Azima 
and/or its work product is intended or authorised. 


The CyberRoot Data contains a number of emails to cameron@powerchord.com. | 
understand that you were a director of Powerchord Limited from March 2015 to February 
2020 and that in your witness statement in proceedings between Eurasian Natural 
Resources Corporation Limited v Dechert LLP (Claim No.: CL-2017-000583) you named 
this email account as one by which you had received what you believed to be a number 


of 'spear phishing’ emails. 


Screenshots of a number of .html files contained in the CyberRoot Data and sent to this 
email address are copied in Annex A to this letter. 


| understand that the hyperlinks embedded in these emails do not take the user to a 
website associated with either Microsoft or Google but, instead, to the domain 


http://www.|nkshrty.me. 


3 Please see paragraph 15 onwards of the Witness Statement of Jonas Rey dated 11 February 2021 (enclosed). 
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If you wish to pursue these matters further that is a matter for you and we would propose 


that you approach Athena Intelligence for further information. 


Yours sincerely, 


Dominic Holden 


Dominic Holden 
For and on behalf of 
Burlingtons Legal LLP 


E dominic.holden@pburlingtons.legal 
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ANNEX A 
BE Microsoft 


New Sign-in Attempt 


You have received this email because we detected your account 
cameron@powerchord.co.uk is recently used to sign in to an 
unrecognized device. 


Details: 

Country/Region: Israel, Jerusalem 
IP Address: 2.16.37.0 

Date; 16 May,2018 


If this was done by you, you can safely ignore this mail 
otherwise please review your activity. 


Remove Device 


Thanks, 
Account Team 


Microsoft Corporation 
One Microsoft Way 
Redmond, WA 

98052 USA 


Copyright 2018 Microsoft Corporation 
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TT Cameron, 


Your Microsoft account (cameron@ powerchord.co.uk) was just used to 
sign-n from an unrecocnized device, using Chrome on Windows LU. 


Login Account Details: 
cameron@powerchord. co.uk 
Windows 10 


12:23 PM. 
Location: China 


Browser: Chrome v66 


Don't recognize this activity? 
Review your recently used devices now, 


Why are we sending tis? We take security very seriously and we want 
to keap you in the Joop on important actions in your account, 

We were unable to deterining whether you lave ased Uris brewer ar 
device with your account before. This can happen when yau siqn in for 
the first tme on a new computer, phone or browser, when you use your 
browser's incognito or private browsing mode or clear your cookies or 
whon somebody olso is accessing your account, 


Sincerely, 
Microsoft Office Support ream 


Microsoft account 


[This message is from trusted sender 
Unusual sign-in activity 


We detected something unusual about a recent sign-in to the account 


c**e**n@powerchord.co.uk. 


Sign-in details 

Country/region: Italy 

IP address: 217.61,124.159 

Date: 5/2/2018 08:10 AM (GMT + 1) 
Platform: Windows 

Browser: Internet Explorer 


If this wasn't you. Please go to your recent activity now and help us secure your account, 
Review recent activity 


Thanks, 
The account team 
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